SuiteAnalytics Connect with OAuth 2.0: Excel and Power BI

SuiteAnalytics Connect is the NetSuite feature that lets ODBC, JDBC and ADO.NET clients query your account with SQL. It is how most finance teams get NetSuite data into Excel, Power BI, Tableau or a data warehouse. Since NetSuite 2026.2, OAuth 2.0 is switched on for every account with Connect, and Oracle calls it the preferred way to log in. It also changes how a scheduled report refresh has to work.

Direct answer: SuiteAnalytics Connect supports three logins: email and password, token-based authentication (TBA) and OAuth 2.0. OAuth 2.0 and TBA work only with the NetSuite2.com data source. With OAuth 2.0, your client passes an access token in the OAuth2Token connection attribute, and that token is valid for one hour. That is fine for a script or pipeline that requests a fresh token before each run. It is awkward for Excel or Power BI using a saved Windows DSN, because the token in the DSN has to be replaced every hour. Oracle recommends a DSN-less connection string for ODBC on Windows for that reason. For dashboards that refresh on a schedule, put a small token service or a data warehouse between NetSuite and the BI tool.

Checked on November 5, 2026 against Oracle's SuiteAnalytics Connect documentation, linked at the end.

---

The three ways to log in to Connect

Oracle's wording on the authentication page: "OAuth 2.0 is the preferred authentication method. You should consider using OAuth 2.0 instead of TBA whenever possible." Enabling OAuth 2.0 does not force you to change the method you use today.

The TBA retirement is covered in our TBA to OAuth 2.0 migration guide. If your Connect setup runs on TBA, it is one of the integrations on that list.

How OAuth 2.0 works with Connect

Connect accepts both OAuth 2.0 grants:

• Client credentials (machine to machine). For pipelines and scheduled jobs. Your server signs a JWT with a private key and exchanges it for an access token. No person signs in.
• Authorization code. For a tool where a person signs in to NetSuite and approves access.

Either way, the result is an access token that you put in the OAuth2Token attribute of the connection. Oracle's notes on that attribute:

• It is not included by default when you install or update the Connect driver. You add it to the connection attributes yourself.
• For ODBC, JDBC and ADO.NET connection strings, it goes at the end of the CustomProperties list.
• For an ODBC DSN on Windows, you add it with the Registry Editor, and "the access token expires after one hour, so you'll need to update it each time it expires. Therefore, the preferred option is using a DSN-less connection string."
• The token "is valid during one hour and can be used in several sessions" during that hour.

Setup for a pipeline (client credentials)

This is the setup Oracle's developer blog walks through, and the one we use for data pipelines.

1. Check the feature. SuiteAnalytics Connect is a paid feature; it must be enabled in the account. OAuth 2.0 is already on for Connect accounts since 2026.2.
2. Create an integration record. Setup > Integration > Manage Integrations > New. Check Client Credentials (Machine to Machine) Grant and only the SuiteAnalytics Connect scope. Save the client ID and secret; they show once.
3. Create a role and user. The role needs the SuiteAnalytics Connect permission plus read access to the records you will query. Not every role can see the NetSuite2.com data source, so test with the role you will use.
4. Upload a certificate. Generate a key pair (RSA 3072 or 4096 bits is the safe choice), then map it at Setup > Integration > Manage Authentication > OAuth 2.0 Client Credentials (M2M) Setup to the user, role and integration record.
5. Request a token before each run. Sign a JWT with the certificate ID as kid and the suite_analytics scope, post it to the token endpoint and read the access token from the response.
6. Connect. Use the NetSuite2.com data source, host <accountID>.connect.api.netsuite.com, port 1708, your account ID and role ID, and the token in OAuth2Token.

If the job runs longer than an hour, open a new connection with a fresh token rather than relying on one long session.

What this means for Excel and Power BI

This is the part Oracle's documentation does not cover, and the one we get asked about.

Excel with a saved DSN. Excel's "Get Data from ODBC" usually points at a DSN. With OAuth 2.0 the token inside that DSN expires every hour, so an analyst who refreshes in the afternoon gets a login error. Options, from simplest:

1. Keep the current method for now (password or TBA) for interactive Excel use, and plan the move to OAuth 2.0 with the rest of your TBA inventory.
2. Use a connection string that is rebuilt before each refresh. A short script requests a token and writes the connection string or updates the DSN; the user runs it, then refreshes. It works, but it is a workaround.
3. Query a copy instead of NetSuite. Load NetSuite data into a warehouse on a schedule and point Excel at the warehouse.

Power BI with scheduled refresh. A refresh in Power BI Service, through a gateway, has nobody at the keyboard to fetch a token. The robust pattern is a pipeline: a scheduled job with client credentials pulls from Connect into a database or warehouse (Snowflake, BigQuery, Azure SQL, or NetSuite Analytics Warehouse), and Power BI refreshes from there. It also takes the reporting load off NetSuite and gives you history that Connect queries alone do not keep.

Troubleshooting

For the tables and joins themselves, see our SuiteQL guide and the NetSuite reporting guide. If you are choosing between Connect and other routes, the NetSuite Snowflake integration post compares them.

---

Sources

• Authentication for SuiteAnalytics Connect (Oracle NetSuite help center)
• OAuth 2.0 for SuiteAnalytics Connect (Oracle NetSuite help center)
• Setting the OAuth2Token Attribute (Oracle NetSuite help center)
• Using Connect with OAuth 2.0 (Oracle NetSuite help center)
• Using SuiteAnalytics Connect with OAuth 2.0 (Oracle Developers blog)

What clients ask before signing

Does SuiteAnalytics Connect support OAuth 2.0?expand_more

How long is a SuiteAnalytics Connect OAuth 2.0 token valid?expand_more

Where does the OAuth 2.0 token go in an ODBC or JDBC connection?expand_more

Can Power BI refresh NetSuite data through SuiteAnalytics Connect with OAuth 2.0?expand_more

Which OAuth 2.0 flow should I use for SuiteAnalytics Connect?expand_more